OIDC cleanup #234

Merged

aaperis merged 4 commits from oidc-cleanup into develop

2026-09-24 15:06:36 +00:00

aaperis commented

2026-09-24 10:59:30 +00:00

(Migrated from github.com)

Description

Now that the project is mature enough it is possible to identify which oidc resources are essential for the webapp and what can be dropped.
This PR cleans up any server fetch of unnecessary OIDC resources, in the spirit of following the data minimization principle for enhancing privacy and security.

Type of change

New feature/refactoring/cleanup

List of changes made

Profile scope dropped. For our purposes, the subclaim suffices.
Dropped the email scope and its guard. Email was only used as a presence check in extractJWT. sub is a strictly better guard
Tightened the /userinfo allow-list. Show "Unknown user" if sub is found empty.
Dropped refreshToken from the encrypted session. This can be added back when the related auth flow is implemented.
Made passport/entitlement scopes configurable per deployment. Added optional new oidcExtraScopes: string[] in sdad-config.json so that if sda-download backend ever needs these or any extra scope they can be passed to the client OAuth configuration upon deployment.

Testing

For the end-user, the only change is how many scopes they are asked to consent to on the LSAAI page when redirected there upon Sign-in.

Run sdad as usual. Sign-out and then sign-in again. In the LSAAI's approval page you should see only one box to tick (scope).
Bring down sdad, add the line: "oidcExtraScopes": ["ga4gh_passport_v1", "eduperson_entitlement"], in sdad-config.json and bring it up again.
Run sdad as usual. Sign-out and then sign-in again. In the LSAAI's approval page you should now see three boxes to tick (scope).

Definition of Done checklist

I have made an effort making the commit history understandable
I have performed a self-review of my own code and commented any hard-to-understand areas
Existing tests are passing and I wrote unit tests for new functionality
My changes generate no new warnings
Documentation Updated (if applicable):
- Relevant documentation is current.

## Description Now that the project is mature enough it is possible to identify which oidc resources are essential for the webapp and what can be dropped. This PR cleans up any server fetch of unnecessary OIDC resources, in the spirit of following the data minimization principle for enhancing privacy and security. ## Type of change - [x] New feature/refactoring/cleanup ## List of changes made - Profile scope dropped. For our purposes, the `sub`claim suffices. - Dropped the email scope and its guard. Email was only used as a presence check in extractJWT. sub is a strictly better guard - Tightened the /userinfo allow-list. Show "Unknown user" if `sub` is found empty. - Dropped refreshToken from the encrypted session. This can be added back when the related auth flow is implemented. - Made passport/entitlement scopes configurable per deployment. Added optional new `oidcExtraScopes: string[]` in `sdad-config.json` so that if sda-download backend ever needs these or any extra scope they can be passed to the client OAuth configuration upon deployment. ## Testing For the end-user, the only change is how many scopes they are asked to consent to on the LSAAI page when redirected there upon Sign-in. - Run sdad as usual. Sign-out and then sign-in again. In the LSAAI's approval page you should see only one box to tick (scope). - Bring down sdad, add the line: `"oidcExtraScopes": ["ga4gh_passport_v1", "eduperson_entitlement"],` in `sdad-config.json` and bring it up again. Run sdad as usual. Sign-out and then sign-in again. In the LSAAI's approval page you should now see three boxes to tick (scope). ## Definition of Done checklist - [x] I have made an effort making the commit history understandable - [x] I have performed a self-review of my own code and commented any hard-to-understand areas - [x] Existing tests are passing and I wrote unit tests for new functionality - [x] My changes generate no new warnings - [x] **Documentation Updated (if applicable):** - Relevant documentation is current.

pdmnyberg (Migrated from github.com) approved these changes

2026-09-24 15:06:09 +00:00

pdmnyberg (Migrated from github.com) left a comment